Interactive display of search result information

• US 10,380,122 B2
• Filed: 10/31/2014
• Issued: 08/13/2019
• Est. Priority Date: 03/14/2011
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Zhang, Steve Yu, Sorkin, Stephen Phillip
• Primary Examiner(s): Wilson, Kimberly L
• Application Number:
  US14/530,689
• Publication Number:
  US 20150058325A1
• Time in Patent Office: 1,747 Days
• Field of Search: 707769
• CPC Class Codes: G06F 16/182 Distributed file systems
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 16/2322 using timestamps
• CPC Class Codes: G06F 16/24 Querying
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/24553 of query operations
• CPC Class Codes: G06F 16/24554 Unary operations; Data partitioning operations
• CPC Class Codes: G06F 16/24575 using context
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 16/2471 Distributed queries
• CPC Class Codes: G06F 16/2477 Temporal data queries
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/334 Query execution G06F16/335 takes precedence
• CPC Class Codes: G06F 16/90328 using search space presentation or visualization, e.g. category or range presentation and selection
• CPC Class Codes: G06F 16/9038 Presentation of query results
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 16/9538 Presentation of query results
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 67/1097 : for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A method, system, and processor-readable storage medium are directed towards generating a report derived from data, such as event data, stored on a plurality of distributed nodes. In one embodiment the analysis is generated using a “divide and conquer” algorithm, such that each distributed node analyzes locally stored event data while an aggregating node combines these analysis results to generate the report. In one embodiment, each distributed node also transmits a list of event data references associated with the analysis result to the aggregating node. The aggregating node may then generate a global ordered list of data references based on the list of event data references received from each distributed node. Subsequently, in response to a user selection of a range of global event data, the report may dynamically retrieve event data from one or more distributed nodes for display according to the global order.

Claims

1. A method, comprising:

causing an aggregating node of a computing system to send, to each of a plurality of distributed nodes of the computing system, a search request to search a set of time stamped events;

causing the aggregating node to generate search result information based on a combination of sub-query results provided by each of the plurality of distributed nodes, wherein the search result information includes event references received from each of the plurality of distributed nodes;

receiving, from the computing system, the search result information, wherein the search result information further includes information associated with one or more time stamped events that satisfy the search request, and the event references include an event identifier corresponding to each of the one or more time stamped events that satisfy the search request;

causing display, within a graphical user interface, of an interactive report generated based on the search result information, wherein the interactive report enables a subsequent input request for additional information about at least a portion of the search result information;

in response to receiving the subsequent input request;

determining a set of event identifiers from the event references corresponding to time stamped events included in the at least a portion of the search result information; and

causing the aggregating node to sends to at least a portion of the distributed nodes of the computing system, a request for time stamped events corresponding to the set of event identifiers;

receiving, from the portion of the distributed nodes of the computing system, the requested time stamped events; and

causing display, within the graphical user interface, of the requested additional information using the received requested time stamped events.

2. The method of claim 1, wherein the event identifier indicates a distributed node of the plurality of distributed nodes that stores a time stamped event and a value indicating a location of the time stamped event in the indicated distributed node.

3. The method of claim 1, wherein the search result information indicates statistical information about one or more time stamped events that satisfy the search request.

4. The method of claim 1, further comprising:

wherein the search request is periodically sent to the computing system;

generating a report based on search results from the periodic search request.

5. The method of claim 1, wherein the search request is sent to the computing system in response to an event occurrence.

6. The method of claim 1, wherein the set of time stamped events include raw data.

7. The method of claim 1, wherein the received requested time stamped events include raw data.

8. An apparatus, comprising:

one or more data processors; and

a non-transitory computer-readable storage medium containing instructions which when executed on the one or more data processors, cause the one or more processors to perform operations including;

causing an aggregating node of a computing system to sends to each of a plurality of distributed nodes of the computing system, a search request to search a set of time stamped events;

causing the aggregating node to generate search result information based on a combination of sub-query results provided by each of the plurality of distributed nodes, wherein the search result information includes event references received from each of the plurality of distributed nodes;

receiving, from the computing system, the search result information, wherein the search result information further includes information associated with one or more time stamped events that satisfy the search request and the event references include an event identifier corresponding to each of the one or more time stamped events that satisfy the search request;

causing display, within a graphical user interface, of an interactive report generated based on the search result information, wherein the interactive report enables a subsequent input request for additional information from at least a portion of the search result information;

in response to receiving the subsequent input request;

determining a set of event identifiers from the event references corresponding to time stamped events included in the at least a portion of the search result information; and

causing the aggregating node to sends to at least a portion of the distributed nodes of the computing system, a request for time stamped events corresponding to the set of event identifiers;

receiving, from the portion of the distributed nodes of the computing system, the requested time stamped events; and

causing display, within the graphical user interface, of the requested additional information using the received requested time stamped events.

9. The apparatus as recited in claim 8, wherein the event identifier indicates a distributed node of the plurality of distributed nodes a computing system that stores a time stamped event and a value indicating a location of the time stamped event in the indicated distributed node.

10. The apparatus as recited in claim 8, wherein the search result information indicates statistical information about one or more time stamped events that satisfy the search request.

11. The apparatus as recited in claim 8, further comprising:

wherein the search request is periodically sent to the computing system; and

wherein the operations additionally include generating a report based on search results from the periodic search request.

12. The apparatus as recited in claim 8, wherein the search request is sent to the computing system in response to an event occurrence.

13. The apparatus as recited in claim 8, wherein the set of time stamped events include raw data.

14. The apparatus as recited in claim 8, wherein the received requested time stamped events include raw data.

15. A non-transitory computer-readable medium storing one or more sequences of instructions, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform:

causing an aggregating node of a computing system to send to each of a plurality of distributed nodes of the computing system, a search request to search a set of time stamped events;

causing the aggregating node to generate search result information based on a combination of sub-query results provided by each of the plurality of distributed nodes, wherein the search result information includes event references received from each of the plurality of distributed nodes;

receiving, from the computing system, the search result information, wherein the search result information further includes information associated with one or more time stamped events that satisfy the search request and the event references include an event identifier corresponding to each of the one or more time stamped events that satisfy the search request;

causing display, within a graphical user interface, of an interactive report generated based on the search result information, wherein the interactive report enables a subsequent input request for additional information from at least a portion of the search result information;

in response to receiving the subsequent input request;

determining a set of event identifiers from the event references corresponding to time stamped events included in the at least a portion of the search result information; and

causing the aggregating node to send to at least a portion of the distributed nodes of the computing system, a request for time stamped events corresponding to the set of event identifiers;

receiving, from the portion of the distributed nodes of the computing system, the requested time stamped events; and

causing display, within the graphical user interface, of the requested additional information using the received requested time stamped events.

16. The non-transitory computer-readable medium as recited in claim 15, wherein the event identifier indicates a distributed node of the plurality of distributed nodes that stores a time stamped event and a value indicating a location of the time stamped event in the indicated distributed node.

17. The non-transitory computer-readable medium as recited in claim 15, wherein the search result information indicates statistical information about one or more time stamped events that satisfy the search request.

18. The non-transitory computer-readable medium as recited in claim 15, further comprising:

wherein the search request is periodically sent to the computing system;

generating a report based on search results from the periodic search request.

19. The non-transitory computer-readable medium as recited in claim 15, wherein the search request is sent to the computing system in response to an event occurrence.

20. The non-transitory computer-readable medium as recited in claim 15, wherein the set of time stamped events include raw data.

21. The non-transitory computer-readable medium as recited in claim 15, wherein the received requested time stamped events include raw data.